// subclass.cpp : Defines the entry point for the console application.
//

#include "stdafx.h"
#include <string>
#include <iostream>
#include <TlHelp32.h>
#include <windows.h>
#include "EnumProc.h"


const LPSTR DLL_NAME = "toolbarButtons.dll";
#define CREATE_THREAD_ACCESS (PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ)
using namespace std;

typedef struct
{
	HWND m_hwnd;
	DWORD m_pid;
} DllPass;

BOOL InjectDLL(DWORD ProcessID, HWND hwnd)
{
	HANDLE Proc;
	char buf[50]={0};
	LPVOID remoteString, MethodPtr;
	DllPass* remoteStruct;

	Proc = OpenProcess(CREATE_THREAD_ACCESS, FALSE, ProcessID);
	MethodPtr = (LPVOID)GetProcAddress(GetModuleHandleA("kernel32.dll"), "LoadLibraryA");
	//save the dll name in the target's memory space
	remoteString = (LPVOID)VirtualAllocEx(Proc, NULL, strlen(DLL_NAME), MEM_RESERVE|MEM_COMMIT, PAGE_READWRITE);
	BOOL rst = WriteProcessMemory(Proc, (LPVOID)remoteString, DLL_NAME,strlen(DLL_NAME), NULL);
	//create a thread to load the dll, dll will start at the main entry point
	HANDLE rt = CreateRemoteThread(Proc, 
                    NULL, 
                    NULL, 
                    (LPTHREAD_START_ROUTINE)MethodPtr, 
                    (LPVOID)remoteString, 
                    NULL, 
                    NULL);
	WaitForSingleObject(rt,INFINITE);
	CloseHandle(Proc);

	/*WaitForSingleObject(rt,INFINITE);
	LPVOID MethodPtr2= (LPVOID)GetProcAddress(GetModuleHandleA(DLL_NAME),"loadInfo");;
	//while(!MethodPtr2)
	//	MethodPtr2 = (LPVOID)GetProcAddress(GetModuleHandleA(DLL_NAME),"loadInfo");
	//remoteStruct = (DllPass*)VirtualAllocEx(Proc,NULL,sizeof(DllPass),MEM_RESERVE|MEM_COMMIT,PAGE_READWRITE);
	//remoteStruct->m_hwnd = (HWND*)VirtualAllocEx(Proc,NULL,sizeof(HWND__),MEM_RESERVE|MEM_COMMIT,PAGE_READWRITE);
	//rst = WriteProcessMemory(Proc,NULL,(LPVOID)remoteStruct,sizeof(DllPass),NULL);
//	remoteStruct->m_hwnd = hwnd;
//	remoteStruct->m_pid = ProcessID;*/
	HMODULE lb = LoadLibraryA(DLL_NAME);
	HANDLE Proc2 = OpenProcess(CREATE_THREAD_ACCESS,FALSE,ProcessID);
	LPVOID MethodPtr2= (LPVOID)GetProcAddress(GetModuleHandleA("toolbarButtons.dll"),"beginLoad");
	/*while(!MethodPtr2)
		MethodPtr2= (LPVOID)GetProcAddress(GetModuleHandleA(DLL_NAME),"loadInfo");*/
	if(!MethodPtr2){printf("%i\n",GetLastError());return 0;}
	LPVOID remoteString2 = (LPVOID)VirtualAllocEx(Proc2, NULL, strlen(DLL_NAME), MEM_RESERVE|MEM_COMMIT, PAGE_READWRITE);
	BOOL rst2 = WriteProcessMemory(Proc2, (LPVOID)remoteString2, DLL_NAME,strlen(DLL_NAME), NULL);
	HANDLE rt2 = CreateRemoteThread(Proc2,
                     NULL,
                     NULL,
                     (LPTHREAD_START_ROUTINE)MethodPtr2,	//address of the method
                     (LPVOID)remoteString2,					//parameter, the dllPass object
                     NULL,
                     NULL);
	CloseHandle(Proc2);
	FreeLibrary(lb);
	return true;
}

void scanWindows()
{
	HWND hwnd = GetTopWindow(0);
	printf("Injecting Dll\n--------------\n");
	while(hwnd)
	{
		DWORD pid;
		GetWindowThreadProcessId(hwnd,&pid);
		LPWSTR st = (LPWSTR)malloc(sizeof(LPWSTR)*80);
		int rst = GetWindowTextW(hwnd,st,80);

		//ignore the idle root
		//must be top-level w/ no parent
		//must not be a hidden window
		if(rst &&!GetParent(hwnd) && IsWindowVisible(hwnd) && !wcsnicmp(st,L"Untitled - Notepad",wcslen(st)))
		{	
			//InjectDLL(pid,hwnd);
			printf("%ls",st, pid);
		}
		hwnd = GetNextWindow(hwnd, GW_HWNDNEXT);
	}
}

int _tmain(int argc, _TCHAR* argv[])
{
	scanWindows();
	printf("\nFinished loading\n\n");
	return 0;
}